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5 TECHNICAL FIELD 

The present invention relates in general to computer network systems, and more 
particularly to a network interface comprising an embedded network traffic analyzer. 

BACKGROUND OF THE INVENTION 
10 Advances in computer network technologies continue to make sharing of 

information between systems increasingly efficient and affordable. Over the course of 
just a few short years, data transfer rates have increased fi-om 10Mbps to 100Mbps to 
IGbps. And the number of possible users on a given dedicated network continues to 
grow. New transmission infi*astructures have emerged including wireless networks. 
1 5 These and other advances have resulted in an increasing exploitation of networked 
systems in government and industry, for both commercial and personal applications. 
Nearly every business or agency which has a need for more than one computer also has a 
need to share information among its' various users. Today, an increasing number of 
homes are either wired for networks or employ wireless networks as the number of 
20 computers in a typical home continues to rise. And there is a proliferation of smaller 

networks being Unked or bridged together to create larger networks; allowing people and 
systems at one location to seamlessly share information with people and systems at 
another location. 

As the quantity, speed, and complexity of networked systems has increased, there 
25 has been a corresponding increase in network problems and an escalating need to 

efficiently resolve such problems. When network problems arise, whether they are on 
ControlNet, DeviceNet, Ethemet, Wireless appUcations, or whatever the latest 
networking protocols and/or configurations may be, information relating to activity on the 
network must be obtained in order to resolve the problem. This generally requires the 
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introduction of a dedicated, stand-alone, diagnostic device to the network known as a 
network traffic analyzer. A network traffic analyzer obtains key information about 
network traffic parameters and is capable of capturing and recording such data to provide 
a permanent record of communications on the network bus. Network traffic analyzers are 

5 capable of being controlled to begin and/or end recording based on the presence of certain 
conditions. Traditionally, a network traffic analyzer is a separate, dedicated piece of 
support equipment. Network traffic analyzers are generally PC based and require specific 
network interface hardware and software modules to adapt to a particular network 
standard or configuration. Often the network must be analyzed and the diagnostic 

1 0 information collected while the network is being utiUzed by the customer in a live 

environment. Trouble-shooting network problems requires configuring a network traffic 
analyzer with an appropriate network interface module and associated software. The vast 
majority of network users do not own the support equipment comprising the network 
traffic analyzer, interface module and associated software necessary for diagnosing the 

1 5 network problems. Therefore, support personnel must assemble the proper resources and 
bring them to the customer's site. Once assembled, a trained operator must be given 
access to the network in order to collect the data necessary for analysis. If for information 
security or other reasons, support personnel are not allowed access to the customer's 
network, or are net permitted to monitor network activities in a live environment, then an 

20 attempt may be made to recreate or simulate the network problems, sometimes in a 

laboratory or other similar environment. Such efforts require the duplication of extensive 
amounts of hardware and software and often result in fiitile attempts to reproduce the 
problem: it may prove impossible to truly duplicate the environment required for the 
problem to manifest itself In almost all cases these options are time consuming, 

25 inefficient, expensive and often are ineffective in resolving the networking problem. 
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SUMMARY OF THE INVENTION 
The following presents a simplified summary of the invention in order to provide 
a basic understanding of some aspects of the invention. This summary is not an extensive 
overview of the invention. It is intended to neither identify key or critical elements of the 

5 invention nor delineate the scope of the invention. Its sole purpose is to present some 
concepts of the invention in a simplified form as a prelude to the more detailed 
description that is presented later. 

The present invention provides for system(s) and method(s) that facilitate 
interfacing to a network. When network problems arise, generally, the most useful set of 

10 data meaningful to network diagnostics as well as prognostics is that which is 

obtained/captured with a network traffic analyzer (NT A). Conventionally, NT As are 
separate, dedicated hardware items that required initially identifying as well as locating 
the appropriate NTA for a given task, and then coupling such NTA to a network to effect 
data capture for diagnostics. The subject invention mitigates some of the disadvantages 

15 (e.g., costs, labor, time. . .) associated with employing conventional NTA schemes. More 
particularly, the present invention provides for network traffic analyzer filter and capture 
capabilities embedded into a network interface. Various configurations of the network 
interface are utilized to allow coupling to any suitable network protocol and configuration 
including, but not limited to, ControlNet, DeviceNet, Ethernet, and Wireless networking 

20 standards. In accordance with one particular aspect of the invention, any suitable device 
with a network interface and having access to the network can be used as a network 
traffic analyzer by embedding additional hardware and firmware into the device. After a 
device is properly configured with the additional hardware and firmware, the device can 
be employed to gather and analyze network data and statistics concurrent with normal 

25 network operations of the device. 

Thus, the subject invention provides for a highly efficient, streamlined scheme for 
utiUzing NTAs, by embedding functionality thereof into existing network interfaces. In 
addition to diagnostics, NTAs in connection with subject invention can employ advanced 
artificial intelligence based schemes (e.g., implicitly and/or exphcitly trained classifiers) 
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to also effect prognostics as to future state/health of the network and components thereof 
in addition to current state/health (e.g., diagnostics) of the network and its components. 

In accordance with another aspect of the invention, the present invention can be 
utiUzed as a network traffic analyzer in lieu of the device's normal operations to collect 

5 and analyze data for trouble-shooting network problems. Complex sorting and searching 
tasks can be performed at a later point in time as post processing operations on a 
computer comprising the present invention, or data gathered by the computer comprising 
the present invention can be transferred via the network to another processor for post 
processing and analysis. Data capture capabilities are often limited in a given networked 

10 device by available memory and memory access bandwidth of the device. In accordance 
with another particular aspect of the invention, a memory controller provides memory 
priority for normal network operations and utilizes remaining available memory 
bandwidth to save network traffic data to memory. In the event more bandwidth is 
required for the network traffic analyzer function(s) than is presently available after 

15 supporting the device's normal network operations, an additional network interface 

module comprising the required hardware, software, and firmware can be utilized in any 
suitable available interface slot connected to the network. If necessary, the additional 
interface module can have its operation dedicated solely for network traffic analysis. 

In accordance with yet another aspect of the invention, one device on the network 

20 is configured with a network traffic analyzer's data acquisition and filter component 
while other devices connected to the network are configured with a network traffic 
analyzer's post analysis and display component. In such a configuration, remote access 
to the device containing the network traffic analyzer data acquisition and filter component 
can be accompUshed by any number of the devices configured with the network traffic 

25 analyzer post analysis and display component. Bridging techniques allow access to and 
control of the device comprising the data acquisition component across one or more 
networks of similar or differing types. According to another aspect of the invention, a 
processor with a network traffic analyzer control component can assume control of the 
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data acquisition and filter component within another networked device located in a very 
remote location firom the device containing the data acquisition and filter component. 

The following description and the annexed drawings set forth in detail certain 
illustrative aspects of the invention. These aspects are indicative, however, of but a few 
5 of the various ways in which the principles of the invention may be employed and the 
present invention is intended to include all such aspects and their equivalents. Other 
advantages and novel features of the invention will become apparent fi-om the following 
detailed description of the invention when considered in conjunction with the drawings. 

10 BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is an illustration of a prior art networked system of multiple devices. 
Fig. 2 is an illustration of a networked system where a dedicated network traffic 
analyzer has been added for diagnostic purposes. 

Fig. 3 A is a high-level schematic diagram of an embedded network traffic 
1 5 analyzer in accordance with the subject invention. 

Fig. 3B is an illustration of a network interface with an embedded network traffic 
analyzer in accordance with an aspect of the present invention. 

Fig. 4 illustrates a device comprising a processor and a network interface 
comprising the embedded network traffic analyzer in accordance with the present 
20 invention. 

Fig. 5 illustrates a device comprising a network interface with an embedded 
network traffic analyzer coupled to a network in accordance with an aspect of the present 
invention. 

Fig.6 is an illustration of more than one device with a network interface 
25 comprising an embedded network traffic analyzer coupled to a network in accordance 
with an aspect of the present invention. 

Fig. 7 A is an illustration of a networked system comprised of n devices coupled to 
network bus in accordance with an aspect of the present invention. 
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Fig. 7B illustrates a divided arrangement of a traffic analyzer according to one 
aspect of the present invention. 

Fig. 8 is an illustration of one device on the network containing the network 
interface data acquisition component and another device containing the network interface 
5 post analysis and display component in accordance with an aspect of the present 
invention. 

Fig. 9 is an illustration of n networked devices coupled together by a network bus 
in accordance with an aspect of the present invention. 

Fig. 10 is an illustration of bridging techniques used to couple separate smaller 
10 networks into larger combined networks are used to allow control of an embedded 

network traffic analyzer from locations far removed from the embedded network traffic 
analyzer in accordance with an aspect of the present invention. 

Fig. 1 1 illustrates one particular methodology for allocating network traffic 
analysis tasks implemented in accordance with the present invention. 
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DETAILED DESCRIPTION OF THE INVENTION 
The present invention relates to networked systems, and more particularly to a 
network interface comprising an embedded network traffic analyzer. The present 
invention provides a system and method for interfacing to a network comprising more 
5 than one device, the system providing an embedded network traffic analyzer. The present 
invention provides basic network traffic analyzer filter and capture capabihties embedded 
mto a network interface, thereby eUminating the need for a separate dedicated network 
traffic analyzer for most routine applications. 

As used in this apphcation, the terms "component", and "system" are intended to 
10 refer to a computer-related entity, either hardware, a combination of hardware and 

software, software, or software in execution. For example, a component may be, but is 
not limited to being, a process running on a processor, a processor, an object, an 
executable, a thread of execution, a program, and/or a computer. By way of illustration, 
both an application running on a server and the server can be a component. One or more 
1 5 components may reside within a process and/or thread of execution and a component may 
be locaUzed on one computer and/or distributed between two or more computers. 

As used herein, the term "inference" refers generally to the process of reasoning 
about or inferring states of the system, environment, and/or user from a set of 
observations as captured via events and/or data. Inference can be employed to identify a 
20 specific context or action, or can generate a probability distribution over states, for 

example. The inference can be probabilistic-that is, the computation of a probability 
distribution over states of interest based on a consideration of data and events. Inference 
can also refer to techniques employed for composing higher-level events fi-om a set of 
events and/or data. Such inference results in the construction of new events or actions 
25 from a set of observed events and/or stored event data, whether or not the events are 

correlated in close temporal proximity, and whether the events and data come from one or 
several event and data sources. 

Fig. 1 is an illustration of a prior art networked system 100 of multiple devices. 
The illustrated network comprises a plurality of networked devices 102, 104, 106, and 
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108. The networked devices are linked together by a bus 1 10. In the illustrated system 
100, the bus 1 10 comprises a CAT 5 wiring cable, but it is understood that the bus 1 10 
can be any suitable medium for transferring data (e.g., COAX cable, telephone cable, 
CAT 3 wiring cable, wireless communications means), or other similar means, for 
passing information between systems. Each networked device is comprised of a 
processor 112 and a network interface 1 14. The networked devices can be various type of 
controller systems, I/O devices and modules, personal computers (PC's), network servers, 
network memory, or other devices comprising a processor and network interface such as a 
network printer, a network scanner or other peripheral device. Each networked device 
requires a network interface 1 14 to provide an interface between the networked device 
and the bus 110. 

In normal operation, by following the proper network protocol, the networked 
devices 102, 104, 106 and 108 each may transmit information to and receive information 
from any of the other devices on the network via the communications means 110. If a 
network problem should arise, it may be very difficult to determine the source of the 
problem. In such cases, a dedicated network traffic analyzer is employed to monitor and 
capture data from the network. 

Fig. 2 is an illustration of a networked system 200 where a dedicated network 
traffic analyzer 216 has been added to the network for diagnostic purposes. As noted, the 
use of a dedicated network traffic analyzer is often time consuming, inefficient and 
expensive for the network user. Most users do not have the necessary support equipment 
(i.e dedicated network traffic analyzer, plug in modules, software, firmware. . .) or trained 
personnel to handle network problems. Furthermore, the presence of an additional device 
not normally a part of the network alters the network configuration and the loading on the 
bus. This can sometimes mask the problem and/or create a new problem. It would be 
beneficial if the network problem could be diagnosed without the need to add dedicated 
support equipment which alters the configuration of the network system and alters the 
load on the bus. 
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Fig. 3 A illustrates a high level schematic diagram of a system 300 in accordance 
with the subject invention. A network interface 302 is shown that interfaces with a 
network bus 304. The network interface 302 includes a network traffic analyzer (NT A) 
306 embedded therein. The NTA 306 by being integrated with the network interface 302 
5 overcomes many of the aforementioned drawbacks associated with conventional NT As 
that are separate items of hardware. The NTA 306 in accordance with the subject 
invention can optionally comprise an artificial intelligence component 308 (e.g., 
impUcitly trained classifier, explicitly tramed classifier, neural network, non-linear 
training component, Bayesian behef network, data fiision engine, . . that facilitates 
10 diagnosing and/or prognosing state/health of a network (and components thereof) that is 
analyzed by the NTA 306. The NTA 306 further comprises a data acquisition component 
component 310 that can provide for filtering and collecting network data so as to provide 
for meaningful analysis thereof by the NTA 306. A control component 312 facilitates the 
NTA 306 to regulate and/or assist with control of network data, the network bus, the 
15 interface 302, the network and/or components thereof. A data store 314 stores 

information relevant to operations of the network and the NTA 306. For example, 
classifiers of the AI component 308 or a portion thereof can be stored in the data store 
314. Likewise, historical data (e.g., lookup tables, data signatures, etc.) can be stored and 
accessed by the NTA 306 to facilitate carrying out functions provided by the NTA 306 as 
20 described within the subject specification. 

Fig. 3B is an illustration of a network interface 320 with an embedded network 
traffic analyzer in accordance with an aspect of the present invention. Network interface 
320 is comprised of various components that implement standard network interface 
protocol along with additional components required to implement an embedded network 
25 traffic analyzer in accordance with an aspect of the present invention. The standard 

components can include a receive modem 322, a receive screeners/filters 324, a network 
operation control component 326, a memory interface 328 and a transmit modem 330. It 
is appreciated that a subset of these components may not be required to effect the subject 
invention, and therefore such components should not be construed to limit the scope of 
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the subject invention. The receive modem 322 is coupled to the network bus 340 to 
receive signals transmitted onto the network bus by other devices. Similarly, the transmit 
modem 330 is coupled to a network bus 340 to transmit signals to the network from the 
device containing the network interface. Although the receive modem 322 and transmit 
modem 330 are illustrated as separate components, it is understood that both components 
can be implemented in a single transceiver component capable of both transmitting and 
receiving information to and from the network bus. The receive modem 322 is coupled to 
the receive screeners/filters 324. The receive screeners/filters 324 determine whether the 
information placed on the network is intended for this particular device. Each device on 
the network is typically assigned a unique identifier. The receive screeners/filters 324 
recognize the unique identifier and determine whether the information on the network is 
intended for the respective device. The receiver screener/fiUer 324 is coupled to the 
receive modem 322, the normal operation control component 326 and the memory 
interface 328. Once determmed that the data on the network is intended for the device in 
question, then the normal operation control component 326 interprets and responds to the 
information accordingly. The memory interface 328 is coupled to receive 
screeners/filters 324, normal operation control component 326, transmit modem 330, and 
external random access memory (RAM) 332. Although the RAM 332 is illustrated as 
being external to the network interface, it is understood that the RAM can be 
implemented internally as well, or RAM 332 can be implemented as a combination of 
both internal memory and extemal memory. As direct by network operation control 
component 326, memory interface 328 uploads data from RAM 332 or downloads data to 
RAM 332 as necessary. Data is then passed as necessary from RAM 332 through 
memory interface 328 to transmit modem 330 and onto the network or from the receive 
screeners/filters 324 and through the memory interface 328 and into RAM 332. 

The network interface 320 with embedded network traffic analyzer is 
implemented as an Application Specific Integrated Circuit (ASIC). The particular 
makeup of the components of the ASIC varies in accordance with the requirements for 
the intended network standard and protocol. Although illustrated as being implemented 
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in an ASIC, it is understood that the present invention can be implemented with standard 
integrated circuits, discreet components, more than one ASIC, a combination thereof, or 
in any manner which replicates the required fimction and the present mvention is intended 
to encompass all such configurations. 

By adding the additional components 334 to the network interface, any suitable 
device comprising the network interface with the additional components can be employed 
as a network traffic analyzer. The additional components 334 are comprised of traffic 
analyzer filters component 336 and traffic analyzer control component 338. Data on the 
network is received by the receive modem 322 and passed to the traffic analyzer filters 
component 336. The traffic analyzer filters component 336 comprises a source media 
access control (MAC) identifier (ID) fiUer component 342, a destination MAC ID filter 
component 344, a packet type filter component 346 (scheduled, unscheduled, etc), and 
other fiher components 350 to capture information pertinent to the network protocol. For 
example, such other filter components may include, but not be limited to a sequence 
number filter component, a packet length filter component, a checksimi data component, 
and any other information pertinent to the given network protocol. The combination of 
all the filters allow the network interface to determine which device is the source of data 
being transmitted, which device is the destination for the data being transmitted, the type 
of information being transmitted, the length of the data being transmitted and other 
information pertinent to diagnosing network problems. Control of the network traffic 
analyzer is accomplished by the traffic analyzer control component 338. The traffic 
analyzer control component includes, but is not limited to, a monitoring component, a 
collection start/stop component, a memory configuration and status component, and a 
memory upload/download component. The monitoring component monitors the normal 
device operations to determine available processor and memory access bandwidth which 
can be utilized for network traffic analyzer fiinctions. The collection start/stop 
component determines conditions for which data collection will start and stop. Start and 
stop conditions can be triggered by many different conditions including, but not limited 
to, time, duration, presence of a particular condition, packet type, or data or absence of a 
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particular condition, packet type or data. The memory configuration and status 
components along with the memory upload/download components help control the 
management of collected data to and from memory. 

The additional components include hardware and firmware to fiilfiU the operation 
as an embedded network traffic analyzer. The added firmware includes extensions to a 
standard debug object to provide an interface to the network traffic analyzer. The 
additional firmware comprises necessary information for the particular network including 
filter configuration, memory configuration an associated status, collection start and stop, 
and network traffic analyzer memory upload. With the additional hardware and firmware 
components, the interface device can start and stop collecting, recording and analyzing 
data in accordance with a prescribed set of conditions. 

By adding the additional components to a device with a network interface, the 
device is configurable as a network traffic analyzer. Fig. 4 illustrates a device 400 
comprising a processor 402 and a network interface 404 with an embedded network 
traffic analyzer 406 in accordance with the present invention. The embedded network 
traffic analyzer 406 is comprised of a traffic analyzer filter component 408 and traffic 
analyzer control component 410, both hardware and associated firmware. When 
connected to a network, the device will fiinction as a network traffic analyzer for the 
network to which it is connected. This is illustrated in Fig. 5 where device 500 
comprising a network interface with embedded network traffic analyzer 502 is coupled to 
a network 504. The device 500 can be a standard PC, a network printer, a network 
scanner, or any device with a network interface to which the network traffic analyzer 
components have been added. In accordance with one aspect of the invention, the device 
500 can be operated in different modes. For example, in one mode the operation of 
device 500 is dedicated to a normal function {e,g. a PC, printing, scanning, etc.). In 
another mode the device 500 can operate as a dedicated network traffic analyzer. While 
in yet another mode, the device 500 combines its normal fiinction(s) with network traffic 
analyzer fimctionalities. In such mode, priority is given to the devices' normal operation; 
the network traffic analyzer functions may utilize excess device resources such as 
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processor and memory bandwidth. In any mode, complex sorting and searching tasks can 
be performed at a later point in time, for example as post processing operations on a 
computer comprising the present invention, or the data gathered by the device can be 
transferred via the network to another processor for post processing and analysis. 

In accordance with another aspect of the invention, more than one device with a 
network interface comprising an embedded network traffic analyzer is coupled to a 
network. Fig. 6 is an illustration of one such system, system 600. System 600 is 
comprised of networked device 602, networked device 604, networked device 606, 
networked device 608, and network bus 610. Each of the networked devices 602, 604, 
606 and 608 comprise a processor 612 and a network interface with an embedded 
network traffic analyzer 614 in accordance with an aspect of the present invention. Since 
one or more devices on network 610 comprise a network interface with an embedded 
network traffic analyzer, any one or more of the devices can function as a network traffic 
analyzer, thereby obviating the need for a dedicated network traffic analyzer. 
Incorporation of the network traffic analyzer components into one or more devices on the 
network removes the need for the dedicated network traffic analyzer. Because the NTA 
can be incorporated into devices which are routinely connected to the network, the 
network configuration does not need to be altered or disturbed to accommodate a 
dedicated network traffic analyzer. 

Accordingly, the ability to diagnose and isolate network problems is improved, in 
accordance with another aspect of the invention. Because adding a dedicated network 
traffic analyzer changes the configuration of the network and the loading on the network 
bus, the manifestation of problems can be altered. Sometimes, the mere addition of an 
additional device, such as a dedicated network traffic analyzer will mask a network 
problem or introduce a new problem. The incorporation of the network traffic analyzer 
into the interface eliminates the need to alter the network configuration and loading 
characteristics by inserting a dedication network traffic analyzer into the network. 
Although the system 600 is illustrated with each device containing an embedded network 



13 



traffic analyzer, it is understood that only one of devices is required to have an embedded 
network traffic analyzer in accordance with an aspect of the present invention. 

Fig. 7 A is an illustration of a system 700 comprised of devices coupled to network 
bus 702. In system 700, device A, 704 is the only device is coupled to network bus 702 
with a network interface with embedded network traffic analyzer 706. The other devices 
are coupled to network bus 702 with network interfaces which do not include an 
embedded network traffic analyzer. If problems exists on the network with 
communications to or fi-om any of the n devices coupled to the network, then device A, 
704 is utilized as a network traffic analyzer to analyze the problem. 

According to one aspect of the present invention, a typical one piece traffic 
analyzer comprising a single stack that performs various associated functions {e.g, 
filtering, data collection, analysis, storage, post analysis, display) can be split and 
positioned at various locations of a network. Fig. 7B illustrates such a divided 
arrangement, which can provide for additional flexibility and an increased efficiency 
when employing available resources on a network. As illustrated in the exemplary 
arrangement according to one aspect of the present invention, functions related to 
filtering, data collection, analysis and storage can be performed at location A on the 
network, and as part of a data acquisition stage, while display and post analysis functions 
can be assigned to another location B on the network, as part of a post analysis and 
display stage. 

In accordance with another aspect of the present invention, one or more devices 
on the network assume control of another device containing a network interface 
comprising the embedded network traffic analyzer's data acquisition component. This is 
illustrated in Fig. 8 wherein two networked devices 802 and 804 are coupled to network 
bus 800. Network device 802 is comprised of a network interface with the embedded 
network traffic analyzer including the data acquisition component 806. Network device 
804 is a device comprising a network interface with the post analysis and display 
component for an embedded network traffic analyzer. Either of the networked devices 
802 and 804 may control the acquisition component of the embedded network traffic 



14 



analyzer embedded in device 802. Networked device 802 can also contain all the 
components typically necessary to function as a fiiUy functional network traffic analyzer 
when commanded. Data acquisition component 806 of networked device 802 can be 
commanded intemally by networked device 802, or extemally through the network bus 
800. The network interface of networked device 804 contains the necessary control 
component 808 to control the acquisition component 806 of the embedded network traffic 
analyzer in networked device 802. In accordance with an aspect of the present invention, 
incorporation of the control component into separate devices allows for remote access 
and control of the various functions of an embedded network traffic analyzer that are 
divided into various locations in a network. Networked device 804 can issue control 
commands through the network interface and onto network bus 800. Networked device 
802 can then receive the commands off network bus 800 and can thereby be remotely 
controlled by network device 804. It is to be appreciated that the control component can 
similarly control more than one post-analysis and display component. 

Fig. 9 illustrates extending this concept to a larger scale. Networked system 900 
illustrated in Fig. 9 is comprised of n networked devices coupled together by network bus 
902. Only one device, 904, in networked system 900 contains the data acquisition and 
filter component 906 required for certain functions of an embedded network analyzer. At 
the same time, the other nA devices contain network interfaces that comprise the network 
traffic analyzer post analysis and display component. As such, any one of the devices 
containing the network traffic analyzer post analysis and display component can perform 
the related functions. It is understood that the present invention can be implemented with 
other arrangements for positioning the various functions of; filtering, data collection, 
analysis, storage, post analysis, and display, associated with a network analyzer at several 
locations on a network bus. 

Fig. 10 extends the concept one level further in accordance with another aspect of 
the present invention. Bridging techniques used to couple separate smaller networks into 
larger combined networks are used to allow control of an embedded network traffic 
analyzer from locations far removed from the embedded network traffic analyzer. In Fig. 
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10, a system of networks 1000 is comprised of three networks, network 1002, network 
1004, and network 1006. Network bridges 1008 and 1010 are used to bridge the 
otherwise separate networks together into a larger more complex network. Network 
bridge 1008 joins network 1002 and network 1004 together so that devices coupled to one 
network may communicate with devices coupled to the other network. Similarly, 
network bridge 1010 joins network 1004 and network 1006 together. With both network 
bridges 1008 and 1010 in place, networked devices on network 1002 can exchange 
information with networked devices on network 1006. Network device 1012 is 
configured with a network interface comprising an embedded network traffic analyzer, 
including the collection, filtering and analysis component 1014. Each of networked 
devices 1016, 1018, and 1020 can also be configured with a network traffic analyzer 
control component. Anyone of these networked devices can issue commands and control 
the network traffic analyzer data acquisition component 1014 of device 1012. 

Although Fig. 10 illustrates 3 separate networks combined by network bridges, it is 
xmderstood that the present invention encompasses bridging and similar techniques across 
a virtually limitless number of and type of networks to allow control of an embedded 
network traffic analyzer fi-om remote locations. Bridging allows combining of different 
types of networks over very long distances. Through use of the many networks of the 
internet, this type of configuration allows device 1020 to be literally located thousands of 
miles firom the embedded network traffic analyzer of device 1012. It is to be appreciated 
that the bridge can have an NTA embedded or integrated therein if desired. 

In view of the foregoing structural and fimctional features described above, 
methodologies in accordance with various aspects of the present invention will be better 
appreciated with reference to Fig. 11. While, for purposes of simpUcity of explanation, 
the methodologies of Fig. 1 1 are shown and described as executing serially, it is to be 
understood and appreciated that the present invention is not Umited by the illustrated 
order, as some aspects could, in accordance with the present invention, occur in different 
orders and/or concurrently with other aspects fi-om that shown and described herein. 
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Moreover, not all illustrated features may be required to implement a methodology in 
accordance with an aspect the present invention. 

In accordance with one aspect of the present invention, the post analysis 
component of the network traffic analj^er also contains a monitoring component. Such 
monitoring component monitors the resource utiUzation (e.g. processor and memory 
bandwidth utilization) of the network device in which it is installed. Fig. 1 1 illustrates 
one particular methodology 1 100 implemented in accordance with the present invention. 
The process begins at 1 102 where the monitoring component is activated in each 
networked device comprising the post analysis and display component. The process 
continues at 1 104 where the networked devices perform their primary fimctions. The 
primary functions may be associated with printing, scanning, PC program execution, or 
any task not associated with the network traffic analyzer fimction. At 1 106, a device 
receives a request that some network traffic analysis needs to be performed. At 1 108, the 
device issues a request to all devices on the network to provide resource utilization fi-om 
the monitoring component. At 1 1 10, each device provides the resource utilization data 
back to the requesting device. At 1 1 12, the requesting device analyzes the resource 
utiUzation data and determines which devices have the greatest amount of resources 
available for the network traffic analysis control and debug fimctions. At 1 1 14, the 
requesting device determines which of the networked devices will execute the network 
analysis fiinction and assigns the fiinctions accordingly. The data acquisition (e.g. 
collection and filtering) and the post analysis filtering fimction may be assigned to the 
same device or the data acquisition fimction maybe assigned to one device and the post 
analysis and display fimction assigned to another device. In either case, at 1 116 the 
designated device(s) perform their network traffic analysis and at 1 1 18 all devices 
continue with their normal operations. This method assures that the network traffic 
analysis is performed as expeditiously as possible without overburdening network devices 
which are sustaining heavy workloads at the time the request for network traffic analysis 
is received. 
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What has been described above includes examples of the present invention. It is, 
of course, not possible to describe every conceivable combination of components or 
methodologies for purposes of describing the present invention, but one of ordinary skill 
in the art may recognize that many further combinations and permutations of the present 

5 invention are possible. Accordingly, the present invention is intended to embrace all such 
alterations, modifications and variations that fall within the spirit and scope of the 
appended claims. Furthermore, to the extent that the term "includes" is used in either the 
detailed description or the claims, such term is intended to be inclusive in a manner 
similar to the term "comprising" as "comprising" is interpreted when employed as a 

1 0 transitional word in a claim. 
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